[HackTuah]

A field or clinical site loses its link and keeps working. Three mechanisms: a hybrid logical clock on every receipt, a durable bounded queue acknowledged in order, and a Merkle comparison on reconnect that records where two chains disagree without rewriting either.

The decision worth your attention

The clock is in the SIGNED payload, not in unsigned meta — against R21's standing rule that platform-set values go to meta.

The reasoning is the whole design: the clock exists so a merge can relate two chains after a partition, and a merge that orders two chains by an unsigned field orders them by something any writer could rewrite afterwards, which would make the merge evidence of nothing. The clock is not disclosure metadata; it is the ordering claim the merge rests on, and an ordering claim that is not signed is not a claim.

If you disagree, the honest consequence is stated in NOTES.md: the merge stops being evidence and becomes a hint.

The cost is a scheme bump to receipt_v3_* (eleven keys; v2 had ten), handled the way slice 124's mapping document says a bump must be:

• Signer.accepted_schemes/0 is the verifier's default allow-list, not the current schemes alone. Defaulting to current would mean bumping the version made every previously signed row unverifiable, which is the opposite of what a bump is for.
• A test builds a v2 row by hand and verifies it under the new code, because that claim needed a row rather than an argument.
• bin/verify_receipt.exs reads both.

Slice 124's census failed the instant the payload gained a field and named the drift in three places. The document was updated; the test was not relaxed.

The merge does not reconcile, on purpose

Two devices that both acted while unable to see each other produced two true accounts of what each did. Nothing available afterwards turns those into one account of what happened, so the merge does not try. Both chains stay exactly as they were; the output is a signed record of where they part company, one conflict receipt per differing position rather than one for the run, because an auditor asking what happened at row 9 deserves an answer about row 9.

A remote export that does not verify is refused before anything is compared, otherwise anyone reaching the merge could write conflict receipts into the local chain by handing it invented rows.

RFC 6962 hashing, and the two details that look cosmetic are not, each with its own test:

• distinct leaf and interior prefixes, without which an interior node's hash can be presented as a leaf;
• an odd node promoted, not duplicated — duplicating is the Bitcoin construction and admits distinct leaf sets with the same root (CVE-2012-2459), which here would mean two different chains comparing as identical.

The queue

The envelope is stored byte for byte and never rebuilt at send time. That is the condition the external authority plane gave on 2026-09-20 when it answered the question this slice was blocked on: their verifiers check a signature over those bytes offline, so a queue may wrap, delay and re-deliver an envelope and may never re-sign it. A test asserts the stored bytes equal the export.

forward_receipt/2 is an optional callback, so no adapter written against ADR-0008's four published callbacks breaks. Local acknowledges immediately, which is what makes standalone Trinity exercise the same path with no adapter at all, as the slice requires.

The bound is a refusal, not a buffer. Past it, effects are denied rather than performed and left unacknowledged. The queue-full refusal is receipted and deliberately not itself queued, because a full queue that cannot record that it is full is a deadlock dressed as a safety property.

Demonstrated red

AC3's guard, by planting a bypass of check_clock/2 (the code and its tests were written together, so a first-run pass proves nothing):

1) the offered clock is behind the chain tail
2) the refusal is itself a receipt on the chain, naming both clocks
3) the refused row is not in the chain, and the chain still verifies
4) an equal clock is refused too: a row must follow, not tie
Result: 10/14 passed

Three bugs found while building, all mine

One would have shipped silently: function_exported?/3 answers false for a module that has not been loaded yet, so the first drain after boot decided the authority could not forward and never asked again. Code.ensure_loaded?/1 first.

Two censuses pushed back, and neither was weakened

• Slice 024's inserter census flagged queue.ex, which writes receipt_queue and never the chain. The census was split and sharpened: the set of files that insert or delete through the receipts Repo is still exactly the writer plus the planted bypass, with a second assertion allowing the queue among files that merely update and checking it never writes a chain schema. Verified by planting a Repo.insert in queue.ex.
• Slice 024's standalone census caught this suite's new test adapters; they were renamed under Trinity.TestAuthority.*, which it already excludes.

mix gate ; echo "EXIT=$?"
prod_check: PASS
3742 mods/funs, found no issues.
trinity.names: OK over 660 tracked files
Result: 904 passed (20 properties, 884 tests), 18 excluded
trinity.coverage: 042 80.31% vs 005 80.31%: OK
EXIT=0

For the reviewer

All five criteria are [auto]; no manual queue. Two judgement calls worth a look:

1. The clock in the signed payload, above and in NOTES.md decision 1.
2. queue_bound defaults to 10,000 per scope and is not surfaced in Settings.

ADR-0008 carries the amendment. docs/07-security-model.md carries the clock, queue and merge section, including what the clock is not worth: it is the host's own untrusted reading, and a deployment needing trustworthy time supplies a trusted source.